CVE-2015-3246: Red Hat Libuser — Race Condition Privilege Escalation

Executive summary

CVE-2015-3246 is a race condition in Red Hat’s libuser library, disclosed by Qualys in July 2015 and quietly resurfaced on August 26, 2026 when CISA added it to the Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of September 9, 2026. Libuser is the account-management library behind userhelper, the setuid-root helper that backs everyday commands like chfn and chsh on Red Hat Enterprise Linux and its derivatives. Unlike traditional Unix account tools, which write changes to a temporary copy of /etc/passwd and atomically rename it into place, libuser modifies /etc/passwd directly. An authenticated local attacker who can interrupt that write at the right moment can leave the file corrupted or, when chained with a second flaw (CVE-2015-3245) in userhelper’s input filtering, inject arbitrary lines into /etc/passwd and escalate to root.

The bug is over a decade old and was patched in 2015. Its appearance in KEV in 2026 is notable less for novelty and more as a reminder that unpatched, end-of-life, or improperly maintained RHEL-family systems (including embedded appliances and legacy build images that still bundle old libuser packages) remain exploitable targets.

Affected versions

• libuser before 0.56.13-8, and 0.60 before 0.60-7 (the versions shipped in Red Hat Enterprise Linux 6 and 7 at the time of disclosure).
• Distributed via the usermode package’s userhelper binary, which is setuid-root and invoked by chfn, chsh, chage, and similar utilities.
• Fixed in libuser 0.62-1 and later. Red Hat shipped patches as RHSA-2015:1482 (RHEL 6) and RHSA-2015:1483 (RHEL 7). Fedora, openSUSE, and other RPM-based distributions that packaged libuser issued corresponding updates in the same window.
• Red Hat Enterprise Linux 5, which was already in its later support phase in 2015, did not receive a fix; Red Hat’s guidance for that platform was mitigation only (see below).

Vulnerability details

Standard Unix account tools such as passwd, chfn, and chsh never touch /etc/passwd in place. They write a full, updated copy to a temporary file and then use rename() to atomically swap it in, so any interruption mid-write simply discards the incomplete copy. Libuser’s generic_mod() routine does not follow this pattern. Instead, per Qualys’s advisory, it opens /etc/passwd directly, takes an fcntl() write lock, reads the file into memory, seeks to the target user’s line, writes the modified line in place, and calls ftruncate() afterward if the new line is shorter than the old one to trim any leftover bytes.

Two design issues make this exploitable:

1. Lock incompatibility. Traditional account tools coordinate access to /etc/passwd using lckpwdf(), a cooperative advisory lock from glibc. Libuser instead uses fcntl() locking on the file itself. The two locking schemes do not recognize each other, so a process using one can freely interleave with a process using the other, defeating the mutual exclusion the lock is supposed to provide.

2. Interruptible direct writes. Because the write happens in place rather than to a temp file, an attacker who can interrupt the write at a controlled byte offset (Qualys’s public exploit does this using RLIMIT_FSIZE to trigger SIGXFSZ/short writes at a chosen offset, combined with process suspension via SIGSTOP/SIGCONT timed against inotify events) can leave /etc/passwd in a partially written state, or, if the ftruncate() cleanup step never runs, insert extra bytes that were never meant to be persisted.

On its own, this corruption causes a denial of service: /etc/passwd inconsistency breaks login, su, and any NSS-based lookup. The escalation path requires chaining with CVE-2015-3245, a separate flaw where userhelper’s chfn() failed to filter newline characters from the GECOS field it accepts (it blocked :, ,, and =, but not \n). By combining controlled newline injection through chfn with precisely timed interruption of libuser’s direct write, Qualys demonstrated that a local attacker could inject an entirely new, attacker-controlled line into /etc/passwd, such as a UID-0 entry, and obtain root. Qualys published a working proof-of-concept exploit (roothelper.c) alongside its advisory.

Exploitation in the wild

CISA’s KEV addition on August 26, 2026 confirms that this vulnerability has been observed being exploited, but CISA’s KEV entries do not include campaign attribution, threat actor names, or targeting details, and no such detail is provided in this notice. Ransomware association is listed as “Unknown.” No public reporting was found tying this specific KEV addition to a named intrusion set, malware family, or sector-specific campaign; the only detailed public technical exploitation reference remains Qualys’s original 2015 advisory and its accompanying proof-of-concept. Organizations should treat the KEV listing as confirmation that exploitation is occurring or has occurred, while recognizing that public attribution detail beyond that is not currently available. Given the age of the flaw and that it requires local, authenticated access, likely exploitation scenarios involve post-compromise privilege escalation on already-accessed RHEL-family hosts, including outdated appliances, containers built from stale base images, or long-unpatched legacy servers, rather than a remote initial-access vector.

Patch and remediation

• Update libuser to 0.62-1 or later (or the distribution-specific patched build): RHSA-2015:1482 for RHEL 6, RHSA-2015:1483 for RHEL 7. Equivalent fixes shipped for Fedora and openSUSE in the same period.
• RHEL 5 and any other end-of-life or unsupported systems that never received a fix should apply Red Hat’s documented mitigation: add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to block unprivileged users from invoking the vulnerable code paths entirely.
• Because this is an 11-year-old CVE, most currently supported RHEL, CentOS Stream, Rocky Linux, and AlmaLinux releases already ship a fixed libuser by default. The practical remediation work in 2026 is inventory: identify legacy RHEL 5/6/7 systems, embedded Linux appliances, or container base images that were built from old package snapshots and never received the 2015 update, and patch or decommission them ahead of the September 9, 2026 CISA deadline.
• Exploitation requires local authenticated access, so this should be prioritized on multi-user systems, shared build/CI hosts, and jump boxes where untrusted local users may have shell access, over single-user or tightly access-controlled servers.

Detection

• Package inventory: Query installed libuser version (rpm -q libuser) across the fleet; flag anything older than 0.62-1 on RHEL 6/7-derived systems.
• File integrity monitoring: Alert on unexpected or out-of-band writes to /etc/passwd outside of normal useradd/usermod/passwd invocations, particularly writes that do not follow the temp-file-then-rename pattern (no corresponding passwd.XXXXXX-style temp file, no inode change on /etc/passwd).
• Audit logs: Monitor auditd or PAM logs (/var/log/secure) for repeated or anomalous invocations of chfn, chsh, or userhelper by non-administrative users, especially rapid, repeated invocations, which would be consistent with a timing-based race condition exploit attempt.
• Process behavior: Watch for unusual process suspension/resumption patterns (rapid SIGSTOP/SIGCONT sequences) targeting userhelper child processes, or processes setting unusually low RLIMIT_FSIZE values before invoking setuid account-management utilities.
• Post-incident indicator: An unexplained new or modified line in /etc/passwd, especially one with UID 0 or an empty password field, on a host where no administrative account change was authorized, is a strong indicator of successful exploitation.

Sources

• Red Hat: libuser vulnerabilities (CVE-2015-3245 and CVE-2015-3246)
• Red Hat CVE-2015-3246 detail page
• NVD: CVE-2015-3246
• Qualys Security Advisory: CVE-2015-3245 / CVE-2015-3246 (technical write-up and PoC)
• Red Hat RHSA-2015:1482 (RHEL 6)
• Ubuntu CVE-2015-3246 tracker